Comment by Roark66 | Hacker News Reader

Comment by Roark66 | Hacker News Reader

Parent Full thread

Private and secure? I thought the main issue with privacy and security of (not at all)OpenAI models is that by using their products you agree for them to retain all the data you send and receive from the models forever for whatever they choose to use it for. Or is this just a thing for free use?

If you pay, do you get a Ts&Cs that don't contain any wording like this? Still, even if there was no specific "we own everything" statement there could be pretty much standard statement of "we'll retain data as required for the delivery and improvement of the service" which is essentially the same thing.

So, any company that allows it's employees to use chatgpt for work stuff (writing emails with company secrets etc) is definitely not engaging in "secure and private" use.

Unless there is very clear data ownership, for example, customer owns the data going in and going out. I can't see how it can be any different. The problem (not at all)OpenAI has in delivery such service is that in contrast to open source models I'm told there is a lot of "secret sauce" around the model(not just the model itself). Specifically input/output processing, result scoring and so on.

The Azure SLAs state that neither the chats are stored nor used for training in any way. They are private and protected in the same way all the other sensitive data is stored on Azure.

On top, you might argue that Microsoft and Azure are easier to trust than a still rather new AI startup.

I agree with your points. Having said that, Microsoft removed my Azure OpenAI GPT-4 access last week without warning. I was not breaking any TOS. Oh well, pointed back at OpenAi.

Can you expand on this because that's pretty alarming...

What kind of volume were you doing and did you use the API for anything other than your listed use case when applying?

6 x 1000 token calls per day, for a news bot (listed use case at application).

I think what happened is the azure subscription was converted from a (multi year) promotional subsidy/discount to a full pay as you go subscription. No change to sub id. Payment methods OK. Everything else continued working, but openai gpt-4 access stopped the next day.

I’d rather use the Azure version because they promise 12-month sunsets vs OpenAI 6-month sunsets for model versions.

You should contact support and if you're up for it document how that goes.

Azure is mostly better for production: the developer experience is awful and the default filtering is more aggressive, but you get dedicated capacity by default which improves latency (something you need to negotiate with OpenAI's sales team for otherwise)

So what do they train it on then?

> Starting on March 1, 2023, we are making two changes to our data usage and retention policies:

> OpenAI will not use data submitted by customers via our API to train or improve our models, unless you explicitly decide to share your data with us for this purpose. You can opt-in to share data.

> Any data sent through the API will be retained for abuse and misuse monitoring purposes for a maximum of 30 days, after which it will be deleted (unless otherwise required by law).

https://openai.com/policies/api-data-usage-policies

Unless required by law… I wonder what law.

"Unless required by law" is wording required to enable a mechanism called "legal hold". If an authority or lawyer discovers some documents for a case they get to prevent their automatic deletion until that case gets closed. Basically, you don't want to lose evidence if there's a warrant or ongoing lawsuit. I really see no problem with that clause in most ToS documents.

Now, I think you can do shady stuff with that wording as well, but I guess you can also get sued if you kept or used an unreasonable percentage of your data longer than when you promised to delete it.

> Basically, you don't want to lose evidence if there's a warrant or ongoing lawsuit. I really see no problem with that clause in most ToS documents.

Perhaps more nit-pickinlgy specific, they may be compelled by law (the courts or an agency with enforcement capacity) to maintain evidence if there's a warrant or ongoing lawsuit.

> is wording required to enable a mechanism called "legal hold"

I don't think this is accurate. At least in Norway you can't "just not" keep records required by law - any section in a contract in conflict with current law would simply be invalid?

I think the section just clarifies that Microsoft will comply with laws requiring them to keep data (eg the "anti-terror" laws that might require data retention).

> Unless required by law… I wonder what law.

Any law. It just makes explicit that a contract can't supercede laws. Even if it was left out, Microsoft is still subject to laws.

The models like gpt themselves are inherently private and secure. They make predictions based on input.

It's what happens in the interface, that is your web chat or API call, which is different per implementation. ChatGPT is an implementation that uses that model and its maker OpenAI wants to keep your history for further training.

But what Azure is doing is taking that model and putting it behind an endpoint specific to your Azure account. Businesses have been interested in gpt, so asking for private endpoints. Amazon is doing the same with Bedrock.

I'm pretty sure the point of this version is not to export data hence the name

This only applies to the api (not chatGPT) their privacy policy states they will keep your requests for 30days and not use it for training. You can also apply for zero retention.

https://openai.com/policies/api-data-usage-policies

Privacy and security... in practice, can mean different things.

In HN-space, it is at its most abstract, idealistic, etc. At the practical level this services is aimed at... it might mean compliance, or CYA. Less cynically, it might mean something mundane. MSFT's guarantee, a responsive place to report security issues.

Reply on news.ycombinator.com